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Dear Admiral Turner: 


The Committee would like to bring to your attention 
the Subcommittee on Evaluation's staff report, Warning : 
An Assessment of Intelligence Community Performance and 
Capability, three copies of which are enclosed. 


The Committee was instructed by the full House to 
conduct a study of the quality of analytical capabilities 
and the organization of intelligence activities. This 
report was prepared pursuant to that direction, and as 
part of the Subcommittee's ongoing consideration of warning 
intelligence. It is intended to serve two purposes: 


to provide information and analysis necessary 
for future consideration of resources and 
evaluation of warning performance? 


to call the attention of the intelligence com- 
munity to areas of relative neglect in indica- 
tions and warning and to the need for more fo- 
cused leadership. 


The Subcommittee has found that warning is a vitally 
important, yet vast and elusive, mission. Effective warning 
draws on the performance of almost the entire intelligence 
community. It also requires the understanding of intelli- 
gence users, since misperceptions about the warning process 
can contribute to "intelligence failures." For these rea- 
sons, warning is a particularly appropriate subject for 
sustained Congressional oversight. 



The Subcommittee on Evaluation plans to hold hearings 
on warning in the fall. Prior to these hearings, it will 
review your response to the Committee's request, made in the 
FY 1979 authorization bill report, for a report on actions 
taken to create a leadership focus for warning. Intelli- 
gence community views on that and other subjects considered 
in the staff report will be solicited at the time of the 
hearings. 25X1 
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Should you wish to comment on the staff report prior 
to the hearings, the Subcommittee will consider your views 
with great interest. 
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PREFACE 

The' performance of the intelligence community is rou- 
tinely judged on the basis of accuracy and timeliness in 
warning. This mission — termed also "indications and 
warning" (I&W) — consists of all the intelligence activities 
that result in alerting national decision makers to the need 
to consider taking some action. 

•. »This study examines the warning process and the organ- 
ization and procedures of the "warning community" — those 
intelligence community elements that hold particular respon- 
sibility for warning. It makes clear that, although impor- 
tant parts of the I&W mission are performed by the Defense 
Intelligence Agency (DIA) ,• the Services, and the Commands, 
warning is not strictly a military responsibility. It is a 
broad mission that requires the resources of the entire in- 
telligence community. 

The response of the "warning community 1 ** to lessons 
demonstrated by past warning and crisis management situations 
is evaluated. The dilemmas inherent in the organization 
and management of intelligence watch centers are discussed, 
and the absence of a focal point for warning leadership is 
noted. 

The need for sustained oversight and policy guidance over 
a wide. range of warning-related issues is stressed, and 

forms the basis of the report's recommendations. 
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I. SUMMARY OF FINDINGS 

This report evaluates present warning capability by 
asking: how well has the "warning community" responded to 

lessons of the past? 

The Subcommittee finds that some lessons have been 
learned more readily than others. Emphasis on collection’ 
and on other problems that can be addressed primarily with 
technology has overshadowed attention to improving analysis S 
and to minimizing uncertainty in the production process. 

Five major lessons are identified: 

Lesson 1: Improved Collection . Every crisis has 
stimulated collection efforts, advances in coverage, timeli- 
ness^ accuracy and frequency. Technical developments and a 
continual learning process have dramatically improved col- 
lection capabilities in most areas. 

Lesson 2: Better Information Management and Warning 
Procedures . Major changes in the organization of the "warning 
community," changes in communications and warning procedures, 
and widespread adoption of automated data processing have 
been spurred by past crises. Due to the absence of a focal 
point for community-wide warning policy in recent years, 
efforts to test the utility of new warning procedures, 
reporting formats, and crisis management procedures have been 
inconclusive. 

Lesson 3: Better Analysis . Analytical pitfalls have i/ 
been recognized in post-mortems and other studies of past 
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warning situations, and limited organizational and training 
efforts have been undertaken in response. Existing mechanisms 
do not ensure that analysts ask all pertinent questions or 
that they confront reasonable alternative hypotheses; the 
use of structured and analytical methodologies is still in 
its infancy, and improving analysis through better personnel 
management receives little concentrated attention. 

Lesson 4; Expectations of Unambiguous Warning . 
Although history has demonstrated that warning is likely to 
be ambiguous, the expectation of collecting unambiguous in- 
dications continues to prevail. There has been little 
progress in developing warning products that reduce unneces- 
sary ambiguity by informing users .of the probability 
of an event, and of the level of the analyst's certainty in 
estimating it. 

Lesson 5; Users' Resistance to Warning . Past 
cases suggest that users' resistance to warning can contribute 
to intelligence failure." Since decision makers' use of 
warning products lies outside of intelligence activities, 
the issue receives little attention from the intelligence 
community. 

Because of relatively little attention to analysis and to 
minimizing unnecessary ambiguity, intelligence performance 
in future warning situations is likely to reveal familiar 
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weaknesses. Enough intelligence will have been collected, 
and, in general, processing and dissemination will be timely. 
While analysis may be good, key questions may not be ad- 
dressed. Differences among the views within the intelligence 
community may not be explicit, and the warning products will 
not indicate changes in the estimated likelihood of an 
event. As a result, the warning judgments received by 
decision makers will be less than clear and convincing. 

The report finds that the persistence of these weak- 
nesses is attributable to a lack of adequate leadership in 
the "warning community." The need for more focused leader- 
ship is evident, both at the community level and in the 
management of the DoD Indications System. 

Therefore, it recommends ; 

• That the Director of Central Intelligence provide 
a focus for warning leadership in the community, which may 

i/ 

require appointment of a special assistant for warning; 

• that the Secretary of Defense and the Services 
provide for the implementation of a comprehensive upgrade 

of the DIA-managed World-Wide Indications and Warning System, 
including clearer demarcation of authority and management 
responsibility among DIA, the Services and the Commands; 
and designation of a single point of accountability within 
DIA for DIA's management responsibilities for the System. 

These recommendations are further detailed in Section VI, 
"Assessment. " 
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II. Warning Intelligence 
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II. WARNING INTELLIGENCE 
A. Warning of What 

The purpose of warning depends on the interpretation of 
* . 

national interests held at any given time by national decision 
makers. It is the President, the Secretaries of State and 
Defense and the Joint Chiefs of Staff, and, in a general 
sense, the broad spectrum of American policy shapers — who 
determine what events would so affect the national interest 
as to require special vigilance. 

The primary focus of U.S. warning activity has been the 
possibility of Soviet surprise nuclear attack. Concurrently, 
major attention has been directed against the possibility of 
Soviet conventional attack in Europe, with the prospect 
of a rapid escalation to nuclear war. These have been the 
dominant national security concerns in the period since the 
second world war, during which the field of intelligence known 
as "indications and warning" has emerged. 

It was in Europe that the United States first undertook 
the systematic monitoring of "indicators," or events that might 
predict attack. "Indications and warning" activity has since 
become worldwide , with certain technical improvements having 
occurred faster in other theaters, but the problem of warning 
in Europe -still being the central concern. Years of analysis, 
several Berlin crises, and the Soviet invasion of Czechoslovakia 
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have resulted in refined lists of indicators, efforts 
to collect warning intelligence systematically, and a 
large corpus of estimative studies. 

It is well understood by the intelligence community 

that Soviet action of any sort threatening to Europe is of 

the highest interest to U.S. decision makers. Similarly, 

* • • - • > ■ « 
the possibility of attack by the Peoples Republic of China 

against Nationalist China, or by a Soviet or Chinese- 

backed North Korea against South Korea, clearly receives 

warning attention. For developments in the Middle East, 

Southern Africa, or other regions, warning requirements 

are relatively less clearly defined. The degree of vigilance 

depends on the extent of Soviet involvement and on the 

way that U.S. leaders at the time define the national 

interest. 

... Although warning of attack on the U.S. and its allies 
quite properly is the major focus of warning activity, 
"warning" as used in this study is not restricted to in- 
formation about attack, or even to information needed for a 
decision to commit U.S. military forces. For example, 
warning about the probable outcome of a conflict between 
Ethiopia and Somalia may be needed to guide U.S. diplomatic 
actions. Even a situation of impending default by heavily 
debt-ridden countries may require warning, for the formu- 
lation of appropriate U.S. economic or diplomatic policies. 
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Similarly, warning may not have to do with sudden, sur- 
prise events. It may require drawing the attention of busy 
decision makers to a situation about which they are already 
aware, but which, in the judgment of the intelligence com- 
munity, embodies significant danger for the United States, 
and therefore warrants closer attention. 

Thus, the warning process consists of all the intelli- 
gence activities fhat result in alerting national decision 
makers to t he need to consider taking some action. 

B. Warning Intelligence 

No absolute distinction can be drawn between warning 
intelligence and other functions of national intelligence, as 
all predictive intelligence has an element of warning. Never- 
theless, warning intelligence can be described as those func- 
tions in which the following four elements are present: 

X) A warning judgment . That is, the intelligence 
community or some part thereof — considers a certain develop- 
ment or change significant enough to warrant special attention 
The judgment might be that of a watch officer, who observes 
a number of unusual indicators of hostilities, and reports 
them at a high level of precedence. Or it might be that of 
an interagency working group which decides that changes in 
the situation it is monitoring warrant the President's atten- 
tion, and prepares a brief Intelligence Alert Memorandum to 
be issued by the Director of Central Intelligence. 
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2) Unusual urgency and salience. Although every 
current intelligence product reflects the producer's judgment 
that the news is significant and deserves to be read, the 
purpose of warning intelligence is to enable appropriate 
leaders to consider taking some action in anticipation of, 

or in response to, a predicted event or situation. There-* 
fore, warning intelligence is produced and transmitted as 
rapidly as possible, and is directed at higher level decision 
makers than most current intelligence. 

3 ) A finished product, actually received by decision 
maker s . This might be a CRITIC message transmitted from 
the field to the President within ten minutes. It might be 
a briefing or a study based mostly on current intelligence, 
or an article drawing attention to the significance of an 
emerging pattern of events. 

4) Initiative largely by intelligence producers, rather 
than users . In warning, the intelligence community must 
assume the responsibility for deciding — sometimes under great 
pressure — what information matters, who must hear it, and 

how urgently. Thus, for example, a study specifically requested 
by decision makers would not normally be a warning intelligence 
product. However, if the product contained an intelligence 
judgment that the situation is much more alarming than the 
decision makers realized, and therefore significantly 
sharpened the focus of their attention on it, it would be 
warning intelligence. 
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C. Warning Terminology 

Considerable definitional confusion surrounds the sub- 
ject of warning. The following distinctions need to be made: 

1) Tactical warning and strategic warning . The DoD 
Dictionary (JCS Pub 1) defines tactical warning as "a 

notification that the enemy has initiated hostilities." 

* .> . * 

It defines strategic warning as "a notification that enemy 
initiated hostilities may be imminent." The distinction 
between tactical and strategic warning is one of time, with 
strategic warning occurring before the attack is launched. 

The actual amount of warning time provided by strategic 
warning may range from minutes to weeks, and there is always 
an element of uncertainty in it. 

2) Tactical warning and intelligence warning . This 
distinction underlines the fact that tactical warning re- 
quires little analytical interpretation. Once intelligence 
systems detect and identify the attacking forces, the role 
of the intelligence community is reduced considerably. 

3) " Big W" and "small w ." This distinction has to do 
with the degree of national interest associated with a 
particular warning problem. It was defined most recently in 
1974 when the position of the Special Assistant for Strategic 
Warning was established. In that DCI directive "strategic 
warning," or "big W," is defined as "the earliest possible 
warning that the Soviet Union, Warsaw Pact, People's Republic 




Approved For Releasi 


: CIA-RDP81M00980R0031 0001 0057-5 



is- 


Approved For Release 2004/05/21 : CIA-RDP81 M00980R0031 0001 0057-5 a 

SECRET 

of China, or North Korea is considering military action by 
its armed forces beyond its borders or is employing its mili- 
tary capabilities beyond its borders in ways that might threaten 
military confrontation with the United States." "Small w” is 
warning of events in regions other than those listed. 

4 ) Indications and warning, and current intelligence . 

* 

Indications, or warning intelligence, is usually performed 
by analysts who also produce current intelligence, and it 
always depends on the same information. (Problems associated 
with closely identifying warning with current intelligence 
are discussed in Section V.) The distinction is that 
"the warning analyst takes incoming scraps, matches them in 
his mind against an indicator list and frequently refers back 
to small nuggets that may have long since lost their current 
intelligence value. The warning analyst may find threat 
overtones in a pattern of events which otherwise, would be 
considered innocuous if viewed piecemeal."- 1 - This is not to 
say that warning analysis should be performed only by those 
predisposed to believe danger is imminent. Good warning 
analysis may sometimes require that the analyst conclude that 
events are actually not as ominous as they may first appear. 

The essential ingredient in warning intelligence is a warning 
judgment on whether a situation represents a danger. 


25X1 


Intelligence , spring 1969. 
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5) Warning and crisis management . The two activities 
are fundamentally different. Whereas warning is a judgment 

or an assessment of probabilities, intelligence for crisis y/ 
management is simply current intelligence performed . under 
pressure. In practice, situations that are being closely 
monitored for indications and warning can become crisis 
management situations once the hostilities have begun. 
Conversely, warning judgments continue to be required for 
the duration of the crisis. The two functions are largely 
performed by watch centers throughout the intelligence 
community, which is another reason that they are sometimes 
considered synonymous. (The development of watch centers 
for indications and warning and crisis management is dis- 
cussed in Section V.) 

6) Warning and prediction . Most warning cannot provide 
an accurate prediction of when, how, or even whether an 
event will occur. In part, this is because of the cyclinal 
nature of the warning process. At a time when available 
evidence supports the issuance of warning, the prospective 
opponent may still have several political and military 
options open. Even if he has decided to initiate an attack, 
his ultimate decision to execute it may be contingent on 
U.S. response. The principal value of the early warning 
judgment is to alert the President in time for him to take 
precautionary measures, to try to deter the adversary, or 

to foreclose particular options to him. 
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Whereas an accurate prediction of the likelihood of 
hostile activity is the desired product of the warning process, 
available evidence sometimes supports only a more general 
notification of Impending activities. Often warning does 
little more than signal a change. The inherent limitations 
of warning are reflected in the definition used in NIE 
4-1-78 on warning in Europe: "an intelligence judgment 

V 

clearly conveyed to national decision makers that the Warsaw 
Pact is taking steps to enable it to go to war in the near 
future and that the course of events has increased the 
likelihood of war in Europe." (Emphasis added) 

This general notification is the minimal product required 
of the intelligence community. In certain circumstances, 
more precise prediction is possible and should be provided. 

In either case, it is the responsibility of the intelligence 
community to avoid unnecessary uncertainties in its warning 
judgments. Decision makers should not have to guess whether 
a given report represents a significant change in the 
intelligence community's judgment of the likelihood of an 
event. Through well structured analysis and appropriate 
reporting formats, the "warning community" should inform 
as explicitly as possible about perceived changes in the 
situation, and about the degree of certainty and of unanimity 
in its warning judgments. As the following sections of this 
study indicate, effective organization and leadership of the 
"warning community" are essential in meeting these requirements. 
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III. THE 


"WARNING COMMUNITY" 


While most of the intelligence community participates to 
some degree in the warning process, it is possible to think of 
a smaller "warning community" composed of those elements that 
hold particular responsibility for this function. It in- 
cludes activities in each major segment of the intelligence 
cycle — collection processing, analysis, and production. 

r.J» 

This section identifies the elements that make up the "warning 
community" and examines the relationships among them. 


A . Collection and Processing 

Most collection resources produce some information 
relevant to indications and warning. With a few exceptions, 
warning intelligence does not require special collection 
systems . 
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As the Cuban Missile Crisis demonstrated in 1962, a picture, 

besides being informative, can be persuasive. Open source 

s * 

/ 

collection can also be important, both for ascertaining 
facts and for evaluating intentions, j 


^ Wire service reports. 


routinely scanned by intelligence analysts, sometimes 
provide the earliest news of a situation of potential warning 
significance. 

Nevertheless, some collection systems are of particular 
relevance to indications and warning, either because of the 
content of material they are designed to collect^ 


, the speed with which the information can 
be transformed into finished intelligence, or because of 
the system's flexibility to be retasked to collect intelli- 
gence in a crisis. 
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possible in each of the disciplines, intelligence on emeiny 
intentions and changes in capability is collected and 
disseminated rapidly enough to provide early warning. 

The part of the "warning community" involved with col- 
lection consists of analysts and managers who develop the 
sets of collection targets for indications and warning, 
who determine where there may be gaps in collection, and who 
undertake special studies and management efforts to improve 
collection for warning. 


B. Analysis 

The "warning community" is largely centered on the 
intelligence production organizations, since the analytical 
process underlies the issuance of a warning judgment. 

Members include the analysts and managers of watch centers 
in each of the intelligence agencies and in Unified and 
Specified Commands around the world. In addition, current 
intelligence analysts who are not assigned to watch centers, 

and area or subject specialists throughout the intelligence 
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community may be participants, depending on events in their 

part of the world. It is these analysts and managers 

who — in products ranging from CRITIC messages to current 

intelligence articles and longer estimative papers — 

decide that a situation requires the attention of policy makers 

Particular responsibility for reaching a warning judgment 
on situations involving U.S. vital interests has been 
assigned to the Strategic Warning Staff (SWS) . This staff, 
located in the Pentagon, consists of eight analysts drawn 
from CIA, DIA, NSA, and the Services, In its weekly and 
monthly publications, circulated throughout the intelligence 
community, SWS assesses the warning significance of develop- 
ments in the Soviet Union, Eastern Europe, China and North 
Korea — the so-called "big W" areas. By soliciting 
reactions and contributions to its assessments, the small 
staff attempts to ensure that analysts throughout the 
intelligence community focus attention on situations of 
potential "big W" significance. SWS also revises the 
intelligence community's lists of General Indicators, 
evaluating different kinds of information — for example, 

— as 

indicators of hostilities. 

Other long-range analysis of the "warning problem" 
is also of direct relevance to the "warning community." 

By predicting the amount of warning time that the U.S. 
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and its allies might have, or by estimating the most likely 
circumstances from which an attack would arise, studies 

25X1 

shape the perceptions of warning held by watch standers, 
managers, resource planners, and consumers. 

finally, certain staff elements that develop and pro- 
mote the use of methodologies for warning analysis partici- 



C. Production 

Warning intelligence involves a decision whether or not 
to produce a special kind of product — one intended to 
alert users to an unusual situation. The decision to 
issue a Special Defense Intelligence Notice or to call a 
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^lert, for example, requires both an analytical 
judgment and a management decision. The individuals who 
bear particular responsibility for establishing or actually 
using these warning vehicles are among the most visible 
members of the "warning community." 

The DCI's Special Assistant for Strategic Warning, 

' , ■' * 

to whom the Strategic Warning Staff reports, has the 

responsibility for preparing a Strategic Warning Notice 
to be issued by the DCI when, in the latter's judgment, 
there appears to be evidence of a "big W" threat. The 
DCI would notify the President and the National Security 
Council, although when time is of the essence the Special 
Assistant, or in his absence, the Director of SWS, could 
send the Notice simultaneously to the President and the 
DCI. When time permits, the Notice is to be coordinated 
within the intelligence community. No occasion clearly 
requiring the use of this warning mechanism has arisen 
since it was established in December 1974, although its 
participants — the Director and staff of SWS, the Special 
Assistant for Strategic Warning, and, of course, the DCI — 
have had occasion to interact more informally either to 
alert the President of an alarming situation, or equally 
important, to provide a judgment that a situation does not 
represent a "big W" threat. 
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Within CIA and the State Department's Bureau of 
Intelligence and Research (INR) , the warning or alerting 
function is not carried primarily by current intelligence 
producers, as it is at DIA. Rather, analysts in each of 
the geographic offices both monitor long-term trends and 

interpret the significance of current events. This 

/ 

approach, in use at CIA only since 1976 when the Office 
of Current Intelligence was abolished, entails certain 
trade-offs, which are discussed in Section V. 

Nevertheless, alert center personnel at CIA and State 
play a major warning role, particularly in crisis situa- 
tions. At CIA a key participant in the "warning community" 
is the Director of the Operations Center. At INR, the 
Director of Intelligence Support and the head of the 
Current Intelligence Staff are participants, as well as 
the Director of the Office of Political/Military and 
Theater Forces. 
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The Director of the White House Situation Room partic- 
ipates in the warning process by assembling items for the 
President's Adviser for National Security Affairs. 

National Intelligence Officers (NIOs) , who in October, 
1977 were joined with CIA's Directorate for Intelligence 
to form the National Foreign Assessment Center (NFAC) , 

* 

hold a responsibility for warning, particularly for 
situations arising outside of "big W" monitored by the 
Strategic Warning Staff. The NIOs were established in 
1973 by the DCI to manage the intelligence community's 
estimative production, and to provide contact among the 
various producers and the users of intelligence about 
given geographic areas or functions. 

The Intelligence Alert Memorandum, a brief notice 
produced under the NIO's direction, was established as 
a special warning mechanism in late 1974, and used for 
less than two years. Issued by the DCI to the President 
and top officials, and disseminated through the intelli- 
gence community, it provided explicit warning of develop- 
ments abroad of major concern to the United States. 

Its purpose was to draw top policy makers' attention to 
the problem. Different elements of the intelligence 
community usually participated in its production, and the 
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finished Memorandum itself was often, although not always, 
a coordinated product. Intelligence Alert Memoranda were 
never formally discontinued, and an Intelligence Community 
Staff Study after the first eleven months reported that 
in general they served the intended purpose well. Changes 
in personnel and major restructuring of CIA and intelligence 
community organizations, however, have resulted in insuffi- 


cers Net (NOIWON) is a conferencing technique adopted by 
Washington area intelligence watch centers as a result 
of urging from Intelligence Community Staff personnel. 
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A NOIWON conference -- which permits a watch officer to 

confer simultaneously with other watch and operations 

centers in Washington — is convened by a watch officer 

whenever a piece of information requires urgent but informal 

consultation in order to help determine its significance. 

NOIWONs are convened whenever a CRITIC is issued, and on 

> * 

the average occur once or twice a week. 

f i.> 

During crises, the "warning community" assumes the 
shape of whatever task forces are formed. Special working 
groups or task forces within agencies are generally the 
responsibility of watch center or current intelligence 
production directors, although the analysts and communica- 
tions specialists who man them, and who therefore are 
major "warning community" players during the crisis, may 
be drawn from other parts of the agency. Under an inter- 
agency mechanism established in 1973 and exercised only 
once so far, the National Intelligence Situation Report 
(NISR) , the DC I designates one agency as Executive Agent, 
and responsibility for NISR production rests with that 
agency's director. 

Certain IC Staff members are also members of the 
"warning community" because of their role in developing, 
promoting, and evaluating warning procedures. Recent 
Intelligence Community reorganization has removed these 
functions from the IC Staff's successor, the Resource 
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Communications systems maintained primarily 
for timeliness during crisis and warning 
situations; 


Data processing systems required for time- 
sensitive tasking of collection systems, for 

t '.A 

storage and retrieval of data by warning analysts, 
for statistical analysis of indicator data, and 
for over-all analyst support in watch centers; 

- Development of indications and warning collection 
requirements , and management of collection personnel; 

- Operation of watch centers and other analytical 
and production resources dedicated primarily to 
warning; 

- Training of analysts, and personnel management; 

- Establishment of warning procedures and mechanisms 
for use within the DoD Indications System, through- 
out the intelligence community, and between the 
community and national-level users. 
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3 . Leadership of the "Warning Community" 

At the intelligence community level, leadership of 
the "warning community" is particularly important in 
three -areas. First , desirable degrees of both coordina- 
tion and constructive debate must be maintained as the 
elements of the community produce warning judgments and 
convey them to intelligence users. Effective warning at 
the national level ’"requires drawing on the full resources 
of the intelligence community to produce its best judgment 
on a situation that may require a decision, and presenting 
that judgment in a sufficiently authoritative form to be 
heard clearly, without suppressing views into a bland 
consensus . 

Second , decisions need to be made at a community level 
to ensure the adoption, use, and evaluation of common 
warning procedures and systems, and to facilitate the 
necessary consultation among community organizations on 
these and other warning-related issues. 

Third , resource management at the community level 
must consider the relative value of proposed new systems 
to the indications and warning mission, and review all 
relevant budgetary decisions to avoid wasteful duplication 
and allow for maximum interaction of warning-related 
systems. 
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In general, the last three to five years have witnessed 
a notable lack of leadership in the first two areas. 
Simultaneously, the degree of community-level activity in 
resource management has increased. 

a * Leadership in Production and Coordination of Warning 

'Judgments ' 

For nearly twenty years, two intelligence 
community mechanises, the Watch Committee and the National 
Indications Center, monitored events that might affect 
U.S. interests, and prepared regular coordinated reports. 

This system was dismantled in late 1974, its functions having 
become stultified, and its objectives diffuse. Since 
then, the community has relied on the Strategic Warning 
Staff (SWS) to monitor the ."big W" threat, and on the National 
Intelligence Officers (NIOs) to manage community-wide 
estimative production on the above and other geographical 
and topical areas. Neither the SWS nor the NIOs (nor 
both combined) fully replaces the Watch Committee as a 
focus for warning. 

Neither SWS nor the NIO mechanism is ideally 
suited to ensure that the appropriate intelligence organizations 
focus analysis early enough on a situation. SWS operates 
in an environment of detached reflection which, although 
conducive to independent-minded and valuable analysis 
deprives it of the visibility and interaction with the 
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res t of the community which would enable it quickly to 
direct community attention to particular questions. 

NXOs in general have the necessary degree of interaction 
with intelligence producers and users m their subject 
areas, but their substantial duties as production managers 
compete with their role in warning. 

Equally important, neither mechanism requires 
that the intelligence community confront differing views 
that may arise from the same set of facts. SWS invites 

- V. * 

responses to the views it expresses in its weekly and 
monthly publications, but the degree of attention given to 
these articles throughout the community is uneven. 

As a result, the task of highlighting or 
reconciling differences among the warning judgments provided 
by the different agencies must sometimes fall to the White 
House Situation Room, which lacks the analytical depth to 
perform it. (See Appendix F.) 

As a forum for focusing community-wide atten- 
tion on the warning implications of current events (which 
may differ from their current intelligence interest, the 

Watch Committee appears not to have been fully replaced. 

^ 25X1 

^ a "lesson learned" was the inadequacy 
of relying on current intelligence for warning. The 
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SWS is fully devoted to indications analysis (although its 
mandate is limited to the "big W" threat) ; the absence ( how 
ever, of a forum that requires the rest of the community to 
consider current events explicitly as indications may 
actually have resulted in a net loss in attention given 
to warning analysis. 

In addition, the role of the Watch Committee 
as a forum for bringing together specialized "warning 
communities" of analysts working on the same problem in 
different agencies has not been fully replaced even by the 
improved communications and teleconferencing techniques 
adopted over the years. Analysts in several community 
organizations have expressed concern that the "warning 
community" may be working with borrowed capital, in that 
it relies on the networks of close personal relationships 
among analysts that were forged during the years when the 
Watch Committee operated. 

There is no individual under the DCI in charge 
of ensuring that the necessary warning mechanisms exist and 
operate as intended. The suitability of current warning 
organizations to do all that is demanded of them — to focus 
community efforts and to provide an independent analysis, 
to be a forum and to ensure diversity of views — goes un- 
monitored. 
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The functions of the Special Assistant to the 
DCI for Strategic Warning are defined rather narrowly. 

He is the primary production officer for the "Big W" 
problem; the Strategic Warning Staff reports through him 
to the DCI. He has not been tasked to oversee the warning, 
process for "small w," or to review the suitability 
and interaction of all the warning mechanisms. In addition , 
during the past year the position has been somewhat under- 
mined in that the incumbent, the DIA Vice Director for 
Production, has been serving in an acting capacity, 
b. Leadership in Warning Procedures 

The absence of a focal point for community- 
wide warning policy over the past five years (which has 
seen five DCIs, seven heads of the Intelligence Community 
Staff and recently its total reorganization, and three 
Directors of the SWS) is evident also in the uncertainty 
surrounding the adoption and apparent discarding of community 
alerting and crisis coordination procedures. 

One such mechanism is the Intelligence Alert 
Memorandum, which, as reported above, was in use for less 
than two years and then fell into disuse, in spite of a 
favorable evaluation by the Intelligence Community Staff. 
Those analysts and managers who have expressed interest 
in having it revived have stressed the need for adequate 
policy guidance from the DCI to ensure its usefulness. 
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Another mechanism whose future use is uncer- 
tain is the National Intelligence Situation Report (NISR) 
task force. The post-mortem prepared after its (only) 
use following the Korean tree chopping incident in 1976^ 
concluded that clarification of mission is required to 
determine the bounds of the task force's analytical re- 
sponsibilities. It found that a decision needs to be made 
whether to confines NISR reporting to intelligence and 
after-the-fact operational and diplomatic reporting or 
whether to stand by the original DCI intent to produce a 
report that will "provide its readership with all intelli- 
gence and operational information bearing on the problem 
at hand, including sensitive intelligence information and 
information concerning U.S. diplomatic initiatives and 
military activities." 8 Effective use of the NISR, or its 
conscious abolition, requires a focus of attention at the 
community level where the decision can be made. 
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Implementation of more routine interagency 


efforts tends also to be slowed by the absence of a point 
in the warning community where such decisions can be made. 



link five major intelligence centers in the Washington area 
in order to facilitate rapid, informal consultation among 
analysts 9 and to make interagency coordination efforts less 
cumbersome. Initiated by members of the Intelligence Com- 
munity Staff and designed by NSA, the system has been in 
development since right after the 1973 Middle East War, and 
was approved by USIB at the end of 1975. By mid-1978 the 
system still was not operational , despite considerable sup- 
port throughout the community. Resistance from certain 
quarters may exist, but at least as significant in stalling 
this relatively simple aid is that its implementation has not 
been the responsibility of any agency. The problem has been 
compounded over the past year and a half by the slow reor- 
ganization of the Intelligence Community Staff. 

Another example is the periodic convening of 
meetings of directors of the Washington area operations 
centers. Meetings have been held irregularly beginning in 
the mid-1960's, when they met several times a year as the 
"Washington Procedural Coordinating Committee" under White 
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House leadership in order to set up a facsimile communications 
system. On occasion, heads of other operational command 
centers and civil emergency centers have participated. 

These meetings have been well received by the intelligence 
community watch centers, and the importance of contact 
between them and non-intelligence watch centers was 
recognized belatedly following the seizure of the Mayaguez, 
an incident which demonstrated the need for regular channels 
of communication between the intelligence community and the 
obscure Hydrographic Center of the Defense Mapping 
Agency. Despite universal approval of these meetings, 
the practice has sometimes lapsed simply because there 
has been no official or agency tasked to host the meeting, 
b * Leadership in Resource Management 

While there has been a notable lack of leader- 
ship in the areas described, the past three or four 
years have witnessed a strengthening of the role of the DCI 
in community- level resource management. This is a development 
of particular importance to the effectiveness of the 
community's warning "system". 

One area in which the effectiveness of the 
warning system--to say nothing of its resource efficiency — 
can suffer particularly is if there is loose management in 
the review of requirements for new systems . In an unconstrained 
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environment, system developers and other advocates are 
free to ascribe "indications and warning" importance out 
of proportion to the analytical community's actual need 
for such a system. Because the "I&W" task itself can be 
defined in various ways, its exact requirements for new 
collection systems, increased timeliness, etc., are not 
self-evident. Up until recently new capabilities could 
be justified on the basis of their "I&W" importance with 
relative ease. If a system could claim the support of the 
relevant USIB, NFIB , or DCI collection committee, it would 
face little further scrutiny. 

The process has: become considerably more 
constrained. One reason is that the intelligence community 
as a whole faces greater resource constraints than in the 
past; the value of any new capability must be weighed 
against alternative uses of the resources. Another factor 
is increased congressional scrutiny. Finally, the role of 
Intelligence Community Staff — now called the Resource 
Management Staff (RMS) in community resource management 
review has increased. A series of RMS studies of intelligence 
missions currently includes an examination of the "I&W" mission 
which attempts to identify the specific tasks associated with 
it, and to measure the expected contribution to that mission 
of any proposed new system. 
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V Nevertheless, the particular difficulties 

of defining the I&W task and setting its requirements de- 
mand that the problem receive regular community- level 



Management of the "warning community" is diffuse, 
causing fundamental policy issues to be approached in a 
piecemeal and sometimes incidental way, while resource de- 
cisions affecting the warning systems are sometimes made 
in isolation from each other. Review of DoD activities 
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IV. RESPONSE OF "WARNING COMMUNITY" TO LESSONS OF THE PAST 


There can be no doubt that the "warning community" has 
learned from lessons of the past thirty years. The shape 
of the community has changed, with new agencies having 
come into existence, procedures having been adopted and 
discarded, technological advances providing new collection; 
communication, and data management capability. Each of 
these changes has originated, or at least been justified, 
as a response to lessons learned in past warning situations. 

Some lessons are learned more easily than others. 

The need for more complete and timely intelligence collec- 
tion is readily perceived after every warning situation, 
and actions are taken to improve these capabilities. 
Weaknesses in analysis and other problems rooted in 
attitudes and habits are more difficult to identify. When 
post-mortems on intelligence failures have forcefully 
identified lessons of this sort, little if any action has 
been taken to ensure that the lessons are learned. 

In the first part of this section, the major events 
that have shaped the "warning community" are reviewed. 

The second part identifies five major lessons derived from 
this review, beginning with those which the community has 
responded to most readily and concluding with those lessons 
which tend to be ignored. 
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A. Changes in the "Warning Commun ity " Refle ct a Learning 
Process 

1. Pearl Harbor 

The intelligence community as we know it had its 
origins in the lessons of Pearl Harbor. The major lesson 
was that mere collection of intelligence does not provide 
warning; there needs to be effective analysis in order to 
sort out signals from "noise." The need to bring together 
intelligence collected from different sources and at 
different times was recognized. Following its investiga- 
tion of Pearl Harbor, Congress passed the National Security 
Act of 1947 creating a Central Intelligence Agency and 
setting up a National Security Council structure, to 
ensure greater coordination of intelligence and decision- 
making within the government. 

Perhaps the single major effect of Pearl Harbor 
on the community was to create a belief in the possibility 
of catastrophic surprise. This attitude was further en- 
grained in 1950 with the North Korean invasion of South Korea. 
Investment in systems |~ [ designed to 25X1 

provide tactical warning of strategic attack, is a measure- 
ment of continued concern about a "bolt out of the blue" 
attack. 

Other more subtle lessons of Pearl Harbor--including 
the need to overcome wishful thinking — have never been fully 
learned, although Roberta Wohlstetter ' s 1962 study of Pearl 
Harbor helped bring these analytical problems to light. 
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2. Cuban Mi s sile Crisis 

The Cuban Missile Crisis in 1962 proved the impor- 
tance of integrated intelligence collection and production 
in crisis management. Intelligence, ranging from HUMINT 
to reconnaissance photography, played an important part 
in every stage of the crisis. The crisis vividly illus- 
trated the value of unambiguous intelligence when decision 
makers need to be convinced rapidly to take action. At 
the same time, analysis of the many chance and routine ele- 
ments 10 that resulted in the October 14 U-2 photographs of 
missile sites suggests that one cannot always expect to 
collect such persuasive and unambiguous pieces of intelli- 
gence . 

The events also demonstrated that in times of cri- 
sis the lines between national and tactical intelligence 
are blurred, as technical collection and rapid communications 
enabled the President to direct the implementation of the 
naval quarantine. By the time of the Vietnam war, further 
advances in communications enabled national decision makers 
to monitor tactical situations thousands of miles away, 
causing the distinction between national and tactical in- 
telligence to become even more blurred. 

3. Czechoslavakia 

The Soviet invasion of Czechoslovakia in 1968 is the 
event which has been most studied by the "warning community . " 


10 p or example, Graham Allison, Essence of Decision, Boston, 
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Most of the mid-level and senior personnel now in the 
intelligence community observed it closely at the time. 
Younger analysts have been trained using this invasion as 
the primary textbook case. Indicator lists, which were 
adapted from British "check lists" during the first Berlin 
crisis in 1949, have since 1968 been further elaborated 
on the basis of study of Soviet preparations for that 
invasion . 

The intelligence community drew two important lessons 
about warning of Soviet attack. On the one hand, Soviet 
preparations would be overwhelming and unmistakable; 
the community had distinguished well among the deployments 
in May for political demonstrative purposes, those 

* 

required for the military exercises in June and July, 
and the continuing, massive preparations for the actual 
invasion on August 20. On the other hand, "the Czech 
invasion. . . reconfirmed that, even with very good 

military indicators and with political indications no 
worse than normal, the prediction of specific Soviet 
actions is difficult and will remain difficult in the 
future . " 

Nevertheless, the fact that the intelligence community 
did not warn that a Soviet decision to intervene with 
military force had been made, or even that such intervention 

25X1 
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was more likely than not, spurred efforts to improve 
collection, particularly the development of near-real- 
time imagery. Study of the events of 1968 also helped 
stimulate the application of the systems approach to 
intelligence collection, in an effort to ensure that 
enough data would be collected corresponding to certain 
indicators to forecast future events. Efforts to speed 
up communications and to facilitate dissemination of 
large volumes of message traffic also resulted. 

4. Vietnam , U.S.S. Pueblo , a nd O ther Crises 

The Vietnam War and a number of sudden crises 
during the war and in the years since have exercised the 
"warning community's" capability for rapid response and 
effective support for crisis management. As a whole, 
these events have further stimulated the adoption of 
automated traffic dissemination systems, and underlined 
the need for rapid and reliable communications. In addi- 
tion, each event has yielded particular lessons of its 
own . 

The seizure of the U.S.S. Pueblo in 1968 demon- 
strated serious weaknesses in the military command and 
control system, and--like the June 1967 bombing by Israel 
of the U.S.S. Libert y- -under lined the need to integrate 
intelligence effectively with military command and control. 
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The shoot-down of a U.S. EC-121 reconnaissance aircraft by 
North Korea fifteen months later dramatized the difficulty 
of obtaining information on U.S. military plans and sensi- 
tive diplomatic initiatives. 

The 1975 seizure by Cambodians of the M ay agu e z , a 
U.S. container ship, in part represented a failure of 
warning; previous threats and incidents against other 
vessels had not been perceived as indications of possible 
action against a U.S. vessel. The major import of the 
incident, however, was in crisis management: in the in- 
ability of the "warning community" to communicate effec- 
tively with elements outside of the intelligence community 
that are occasionally involved in crisis management. At 
the time of the Mayaguez no one in the intelligence com- 
munity watch centers knew how to alert merchant marine 
vessels; they did not know that the Hydrographic Center 
of the Defense Mapping Agency performed this function. 

In 1976 the attack by North Koreans on U.S. 
soldiers in the D.M.Z. who were chopping a tree sparked a 
brief but serious confrontation. The event 
carried significance for the intelligence community in two 
very different ways. Substantively, it underlined the 
continuing difficulty of collecting against North Korean 
intentions. I 
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doctrine hampered interpretation of technical intelligence 
collection. In a procedural sense, the tree chopping crisis 
provided the occasion for the first and only exercise of a 
community-wide process designed to provide decision makers 
with a coordinated National Intelligence Situation Report. 

5. O cto ber War 

The intelligence community failed to predict the 
October 1973 Arab attack on Israel. Despite earlier pre- 
dictions in the spring of 1973, during the summer and fall 
DIA, CIA, and INR all were providing assurances that there 
would be no imminent attack. 

A post-mortem report by the Intelligence Community 
Staff began with a statement "there was an intelligence 
failure in the weeks preceeding the outbreak of war . . 

and squarely placed the blame on producers rather than col- 
lectors . 


/ 


Perhaps more than at arry rmre - 


since publication of Wohlstetter ' s book on Pearl Harbor, 
attention focused on the pitfalls of analysis and on the re- 
lationship between intelligence and consumers. 

The major recommendations concerning analysis and pro- 
duction that came out of this review process have not been 
implemented, although further study has occurred. A 
community-wide review of warning procedures, publications, 
doctrines and analytical methodologies was proposed. 
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Systematic reporting of probability was advocated, as was 
the adoption of a coherent national family of products for 
publication during crisis. In general, however, decisions 
on common alert mechanisms and procedures have largely 
awaited the emergence of a leadership focus for warning at 


the community level and within DoD. 



faction with the Watch Committee had been long-standing, 


largely because it had broadened its focus to include so 
many areas that its primary attention to the Soviet Union 
and China was diluted. To this initial dissatisfaction the 
failures of October 1973 added another: the Watch Committee/ 


NIC mechanism had not adequately performed the long-term 
trend analysis essential to warning. Rather, it had be- 
come little more than the synthesizer of current intelligence 
production, and the October War showed that short range in- 
dications can be correctly interpreted only when sufficient 
long range analysis has been done to establish a proper 


framework . 

Military indications had been collected during the 
summer and fall which, although not conclusive, would have 
been sufficient to prompt a warning of the growing possi- 
bility of Arab attack. An NIE in May had indicated the 


danger of war 
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Soviet summit meeting should pass without any result judged 
useful by Cairo. An INR report had further underlined that 
danger. Attitudes within the intelligence community caused 
analysts to discount much of the current military indications, 
and the long-term perspective which might have overcome these 
attitudes was lost in the attention to current reporting. 

Thus the mechanisms established after the Watch Committee 
the Strategic Warning Staff and the NIOs — were intended to 
ensure that the long-term context would not be lost again. 

6. Recent Experience 

On several occasions over the last two years the 
"warning community" has had to consider whether a situation 
marked by a number of unusual indicators actually repre- 
sented a danger to the U.S. One such occasion occurred in 
the Spring of 1977 when Soviet harassment of U.S. patrols 
in East Berlin coincided with East German mobilization 
exercises and a number of other circumstances of potential 
concern. All elements of the "warning community" were in- 
volved in monitoring this situation, and ultimately judged 
that there was not an imminent threat. Although this 
judgment was sound, the production process resulted in a 
degree of confusion and uncoordinated effort by the various 
community elements. This further underlines the need for 
community — leve 1 leadership to establish and oversee alerting 
procedures . 
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B . Five Lessons, Partl y Learned 

The major events described above, together with 
more routine experience accumulated over the years, have 
brought about changes in capabilities, procedures, or- 
ganization, and perceptions. The following discussion 
of five lessons from the past distinguishes between 
those which tend to be "learned 1 readily, and those 
which — even if widely recognized— have not brought about 

much improvement. 

Less on 1. Improved Collection 

Ironically, reports written about every intelligence 
failure have indicated that enough intelligence was 
collected to prompt a warning; the major reasons for 
failure lay elsewhere. Yet, the first and most invariable 
response to any past crisis, whether or not it was con- 
sidered a "failure," has been to increase collection 
capabilities and improve timeliness. 

For example, following the Czech crisis and the post- 
mortems on it, the United States Intelligence Board (USIB) 
met repeatedly to consider action to be implemented on 
the basis of the studies' recommendations. Although im- 
provements in collection constituted only a part of the 
recommendations received, USIB directed its formal action 
in the months following the crisis almost exclusively at 
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Procedures 

Every crisis has provided examples of breakdowns in 
the flow of information. Typically, the volume of message 
traffic doubles, and the number of participants increases 
with the formation of new working groups, task forces, 
etc. Although the opportunities for significant pieces 
of information to be literally "lost in the system 
are few, delays can occur in transmitting reports to 
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the right people. Insufficient attention can be paid to 
an emerging pattern of events, and even when the warning 
judgment is reached by one element in the community, it 
can fail to catch policy makers' attention because it is 
submerged in a flood of current intelligence. 

25X1 


The intelligence community has been sensitive to parts 
of this problem. Automated cable dissemination systems 
have been adopted and the communications systems linking 
watch centers with each other and with collectors have been 
steadily improved. These efforts have been stimulated by 
the invasion of Czechoslovakia, when receipt of certain 
technically collected information was slow; the seizure of 
the Pueblo, when poor communications and procedures impeded 
both intelligence and command control; and the October War, 
which was marked by delays in the receipt of intelligence 
about the tactical situation. Spurred largely by the 
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flood of paper generated during the Vietnam War and by traffic 
dissemination problems during the October War, intelligence 
community organizations established procedures and provided 
facilities for crisis task forces and working groups. 

While traffic dissemination systems, task forces, and 
other procedures for coping with floods of data have been 
tried with varying degrees of success, it is notable that 
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rxpejLience w±tn past crises is t^tldcted m the adoption 

of new communications procedures, although implementation can 
sometimes be very slow. Minor procedural changes have been 
made in the CRITIC System, 


The NOIWON represents the most significant new procedure to 
be adopted by the "warning community," in that it made it 
both technically possible and organizationally feasible to 
bring an item of warning intelligence immediately to the 
attention of all Washington area watch and operations centers. 

/ Post-mortems on the Pueblo seizure and EC-121 shoot-down 
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demonstrated the need for such a system, as did subsequent 
crises. Implementation of the NO I WON, a technically simple 
and inexpensive conferencing system, occurred only in 1974, 
after its need was again demonstrated during the 1973 
October War. 

A lesson learned during the Mayaguez affair was the 
need for regular channels of communication between intelli- 
gence community elements and those elements of the U.S. 
government that manage or monitor certain emergency situa- 
tions. A list of all Washington area watch centers was pre- 
pared in the aftermath of the crisis, and a worldwide direc- 
tory of watch centers was prepared with the assistance of the 
Intelligence Community Staff in 1976. 

Whereas these procedural responses have occurred with 
relative ease, problems of compartmentation have been more 
intractable. Past crises have yielded numerous examples 
where the inability of warning analysts to take into account 
reports in highly compartmented intelligence channels, in- 
formation about U.S. military operations, or knowledge of 
U.S. diplomatic activity has contributed to intelligence 
failure or has added to confusion and delay in crisis man- 
agement. In 1963 NSAM 226 established a policy which re- 
quired that the Watch Committee be provided all warning 
relevant information "without restriction because of source, 
policy, or operational sensitivity." Nevertheless, 
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immediately preceding the outbreak of the October War the 
CIA judged that certain clandestine reports were too sensi- 
tive for Watch Committee use. 


Information about diplomatic exchanges between U.S. and 
other officials would appear to be essential to warning 
analysis. Yet the inherent sensitivity of high-level ex- 
changes, particularly during periods of tension, often 
causes policy makers to hold this material in diplomatic 
channels. Nowhere was this tendency more evident than in 
the Middle East diplomacy under Secretary of State Henry 
Kissinger. Undoubtedly a contributing factor in the 1973 in- 
telligence failure was analysts' recognition that they were 
not privy to Kissinger's conversations with Arab leaders? 
as long as Kissinger was not alarmed, analysts tended to 
discount the significance of their own military indicators. 

As recently as spring 1977, when intelligence analysts were 
trying to assess the seriousness of events surrounding U.S. 
"flag tours" in Berlin, the intelligence community did not 
have full access to information about U.S. diplomatic re- 
sponse to Soviet actions. 

The problem of access to operational intelligence has 
received considerable attention, and measures taken to 
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Lesson 3. Better A nal ysis 

Post-mortems and critiques written both within and 
outside of the intelligence community have drawn from past 
crises a considerable body of knowledge about the ana- 
lytical process and common pitfalls in warning analysis. 
Wishful thinking, losing important information amid sur- 
rounding "noise," and succumbing to the "cry wolf" syndrome 
have become familiar concepts. 

The failure to address key questions has been iden- 
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Studies of the October War show that again there 

was a failure to ask all the necessary questions. Assuming 

* 

that they could not win a military victory, might the 
Arabs nevertheless perceive advantages in initiating 
hostilities? How did the Arabs view U.S. and Israeli 
attitudes toward negotiations? 

Although the analytical failures revealed in the studies 
of past crises are relatively familiar to the "warning com- 
munity," efforts to improve analysis have been uneven, 
sometimes driven as much by the availability of new 
technology as by a deliberate effort to avoid past ana- 
lytical mistakes. Although it is widely understood 
throughout the intelligence community that the key to 
effective warning is good analysis, major improvement ef- 
forts have focused elsewhere. One reason for this un- 
doubtedly lies in the difficulty of defining what the 
warning analytical process is, and deciding what approaches 
should be taken to improve it. 

Some significant organizational changes have been 
made to improve warning. The existence since 1974 of a 
Strategic Warning Staff, which bears no responsibility for 
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current intelligence reporting, can be expected to ensure 
that, at least for the "Big W" target areas, the "warning 
community" will not lose sight of the long-term picture 
the way it did in the Middle East during the summer and 
fall of 1973. 

The trend toward all-source analysis has affected 
warning analysis in recent years. Watch center analysts 
who earlier handled incoming traffic on a source-by-source, 
and sometimes compartmented basis, now are able to monitor 
all intelligence bearing on a particular region of the 
world. Greater interaction between NSA and other elements 
of the community has developed over the past five to ten 
years, with NSA personnel participating more in community 
seminars and serving as liaison with other community elements 
and operational users. This interaction, as well as modest 
new efforts undertaken by DIA and NSA in the wake of the 
October War, are felt to have improved the ability of 
warning analysts to make effective use of SIGINT material. 

It is apparent, nevertheless, that substantially more 
effort of this sort is required to ensure that analysts 
throughout the community make optimal use of all-so.urce 
information. 

The last five years have seen increased interest in 
"methodologies." Still in its infancy, this interest has 
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taken several forms and in general has not been very focused. 
Contractual studies have been performed; computerized ana- 
lytical aids have been developed and are being tested; 
training materials have been developed. To a greater or 
lesser extent throughout the community, efforts have been 
made to encourage and assist analysts in applying appro- 
priate non-intuitive methodologies to particular analytical 
problems. These techniques include Bayesian analysis, 

Delphi process, causal mapping, the use of charts and 
graphs, quantitative content analysis, etc. Most warning 
analysis, however, continues to be performed largely by 
intuitive means — much as it was ten years ago. 

This is not to imply that the traditional approach 
is unsound — an experienced analyst's intuitive under- 
standing of a situation will continue to be essential to 
warning, regardless of what quantitative aids or elabor- 
ate methodologies are employed. The major value of more 
structured techniques is that they may help overcome ana- 
lytical bias. 

25X1 


Approved For Release 2004/05/21 : CIA-RDP81M00980R0031 0001 0057-5 

SECRET 




Approved For Release 20 


$E8ftE<! IA -' 


RDP81 M00980R0031 0001 0057-5 


66 


25X1 


Another approach to improving analysis is to try to 
ensure that the right questions are asked. Although studies 
of past crises have pointed to the need for just this kind 
of effort, relatively little appears to have been done in 
this area. A DoD review of the October War urged the es- 
tablishment of "challenge teams" of experienced officers 
who would force the analysts to justify their views and 
to examine conflicting hypotheses. 

The NIO structure, established in 1973, was intended 
to manage the production of estimative intelligence. Some 
NIOs, although not all, do involve themselves in current 
and warning intelligence sufficiently to provide some of 
the necessary guidance. Even if all the NIOs were equally 
able to perform this function at the community level, 
there would be a need for better management mechanisms 
within each element to continually prod analysts to review 
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assumptions underlying their judgments, to consider alter- 
native hypotheses, and to ensure that the right questions 
are asked. 

The importance of asking follow-on questions— f 


r 
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J-has not been fully recognized in the community. Not - 


only has little effort been made organizationally to pro 
vide this sort of challenging management, but the com- 



is well trained, highly motivated analysts. It is also 
accepted that, although there are many highly skilled and 
experienced analysts, improvements are needed. 
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high priority. What is needed on the one hand is a 
community-wide effort to provide the "challenge teams," 
training, and methodology support staffs to ensure that 
analysis is directed at the right questions and that ap- 
propriate techniques are used. 


Lesson 4. Expectations of Unambiguous Indicators 
Warning analysts must not expect to find unambiguous 
indicators. No lesson of the past has been clearer than this 
one. Even the Japanese "winds code" signals, widely charac- 
terized later as unequivocal warnings of surprise air attack 
on Pearl Harbor, were in the context of the other intelli- 
gence being received in December 1941, "not merely ambiguous 
but occasionally inconsistent with such an attack. ^ 

The invasion of Czechoslovakia provides textbook examples 
of the kinds of ambiguities that warning analysts must be 
prepared to cope with. ' Although massive amounts of intel- 
ligence can be expected to show that preparations for 
attack have been made and that the chance of attack is 
great, analysts must not count on receiving word that the 
political decision to execute the attack has actually been 
made,. The problem is compounded if readiness has been 

Roberta Wohlstetter, Pearl Harbor Warning and Deci- 
sion , Stanford University Press, 1962, page 388. 
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achieved in a preliminary build up (as it was in 
Czechoslovakia) , since final preparations for attack may 
be rapid and difficult to collect. Nevertheless, the in- 
telligence community has repeatedly expected to collect 
concrete, clear indicators immediately preceding an attack. 

25X1 


warning process. At the very least, warning of a govern- 
ment s actions can be no more definite than the decisions 
which that government's own leaders have made up to that 
point. Even if a decision to attack has been made, it has 
probably been made contingent on a number of other circum- 
stances, including political or military actions by the 
U.S. Decisions on the specific timing and location of 
attack are typically contingent also on a number of last- 
minute factors. 

Another factor that increases ambiguity is that an at- 
tack or other hostile action is typically part of a cycle 
of action and reaction. In a period of tension two or more 
nations may take a long succession of measures designed to 
deter the other, to signal their own intentions or to ex- 
plore the other's, to increase military preparedness, to 
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elicit third-country support, and to consolidate domestic 
support. Actions taken for all these purposes may trigger 
reactions from the other side. This complicates the job 
of the warning analyst, who must distinguish action from 
reaction in order to interpret the other side's intentions. 

The intelligence community must find ways to minimize 
unnecessary ambiguity. It must structure its reporting so 
as to provide policymakers with the clearest and most use- 
ful analyses consistent with available intelligence. This 
requires serious effort in three areas. 

First, information about U.S. military operations and 
^iplcm^tic exchanges must be available to the intelligence 
community, and warning analysts must integrate this infor- 
mation effectively with available intelligence. 

Second, reporting formats for warning intelligence, as 
for all predictive intelligence, should enable users to 
understand clearly when analysts are detecting a change. 
Judgments of the likelihood of attack, for example, should 
be presented in a sufficiently structured way so that the 
policymaker can readily see whether analysts are predicting 
an increased or decreased likelihood of attack. Reporting 
that tracks intelligence judgments over time in this way 
would of course not eliminate ambiguity. It would, however, 
help to overcome sources of uncertainty that tend to 
undermine users confidence in and effective use of warning 
judgments: inconsistent terminology, the inability to com- 

pare warning judgments over time, and the inability of the 
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analyst to convey a sense of his own certainty or uncertainty 
in a given judgment. 

Third, the intelligence community bears responsibility 
of helping users to understand the inherent uncertainties 
of the warning process. To encourage the widespread assump- 
tion that unambiguous warning can realistically be expected 
is to seriously mislead policymakers. Yet the tendencies to 
do this continue to be strong. The recent 


is careful to point out that warning can be ambiguous. Yet 
taken as a whole, the|~^ 


perpetuates the idea that critical 

warning will be available during the last few days and 
hours before attack, and that such warning will be suffi- 
ciently free from ambiguities to permit the responsible 
decision makers to undertake necessary action. The 


hardly acknowledges action and reaction as a source of 
ambiguity in warning of Soviet actions. 

Lesson 5. Users' Resistance to Warning 
Effective warning requires receptivity by intelligence 
users. This is the most difficult lesson. History provides 
ample illustration to suggest the futility of warning if 
decision makers are unwilling to accept warning or are unpre- 
pared to deal with the terms in which the warning comes. 
Nevertheless, the problem of users' attitudes is not dis- 
cussed much within the intelligence community. 

The fact that users are not part of the intelligence 
community limits discussion of the problem. Because studies 
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of intelligence failures, in particular the detailed post- 
mortems that have been prepared within the community, do 
not deal with the subject, less is known about how user 
attitudes contribute to intelligence failures than is 
known about other causes that lie within the intelligence 
community. 

Nevertheless, it is possible to identify two general 
reasons why national decision makers might resist accepting 
warning. First, there is a psychological reason. Accepting 
warning may represent an admission of failure. To accept 
warning, the policymaker must first accept the likelihood 
that his own policy of military deterrence or political 
negotiation has failed. 

The second basic reason is that it may be politically 
difficult for a leader to accept warning. To accept the 
probability of hostile action may require a decision to do 
something that is politically unpopular. In some cases the 
decision maker may feel that the wisest course of action is 
to do little or nothing in response to the prediction, but 
is reluctant to appear weak or isolationist. In other 
cases the decision maker may wish to respond aggressively 
but recognizes his country's unwillingness to respond with 
force. In either case the decision maker might find it 
useful to relieve himself of some responsibility by in- 
sisting after the event that no warning was given. No in- 
telligence failure can be attributed entirely to the 
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attitudes described above, but it is likely that these 
attitudes were contributing factors in most failures. 

In addition to these basic reasons, there is another 
reason that may prevent decision makers from accepting 
warning. It is more complex but probably equally prevalent. 
Policymakers may not be prepared to take action in response 
to ambiguous intelligence. In some circumstances the 
decision maker may'adopt "hedging" actions in response to 
uncertain judgments; the actions taken in response to 
available intelligence during the Cuban missile crisis were 
geared to match the uncertainty about Soviet actions and 
intentions. In other cases such "hedging" or precautionary 
actions are not available, or may be viewed as too risky, 
given the degree of uncertainty in intelligence. In such 
cases, the decision maker would be unable to find any 
appropriate response other than inaction, given the degree 
of uncertainty in the warning judgment. 


C . Summary 

The lessons to which the intelligence community has re- 
sponded most fully are those that can be addressed by 
fielding new collection systems, improving timeliness of 
collection, communication, and traffic dissemination, and 
making limited organizational changes. Other lessons have 
been "learned," in that everybody seems to understand their 
importance, but implementation of improvements has been 
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very slow: overcoming compartmentation problems, particu- 
larly between intelligence and operational and policy 
channels; \ 


J One reason these problems are so m- 


tractable is that they involve so many players, including 


ones outside of the intelligence community. 

The emphasis on collection and on other problems that 
can be addressed by technical means has overshadowed at- 


tention to improving analysis. Certain new 

efforts are being made to improve analysis, among them the 

j and the development of videotaped training 
courses. In general, however, these efforts have been small, 
and their effect at best has been to ameliorate a situation 
rather than to address the fundamental problems of personnel 
turnover, management, and morale, which limit analyst 
performance. 

The lessons that have been most difficult to learn have 
to do with attitudes of intelligence producers and users 
toward the warning process itself. Much greater understanding 
is needed both of the inherent ambiguity of warning, and of 
the need to minimize all unnecessary uncertainty and confusion 
in the production process. 

It is not enough to warn. To be effective, the warning 
must convince the user of the need to make a decision. To 
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help the user make the decision, which might range from a 
precautionary step to ordering full mobilization, there 
must be more than a judgment of "war" or "no war." The 
decision maker must know whether the event is now judged 
more likely than previously, and whether the intelligence 
community is more certain of this judgment than it had 
been . 

This understanding is clearly necessary if decision 
makers are to respond confidently to an intelligence warning 
of attack. It is equally important in ensuring that policy- 
makers accept a warning judgment that a given situation does 
not represent a serious threat, and thereby avoid dangerous 
overreactions. 
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V. WATCH CENTERS: EVOLUTION, ISSUES , CHOICES 

A shift in the role assigned to intelligence watch 
centers, emphasizing crisis management, occurred in the 
1960s. This reflected a change in the dominant national 
security concern, which during much of the 1950s was sudden, 
massive attack. In the 1960s concern focused on Communist 1 
backed insurgencies, and on the "management" or crises, 
from the Soviet missiles in Cuba to instability in the 
Dominican Republic. Today's watch centers continue to 
serve two functions: supporting crisis management, and 
contributing to warning. 

The two functions are quite different. A strategic 
warning watch center monitors a set of indicators, forms 
judgments about the seriousness of observed abnormalities, 
and alerts top decision makers rapidly if it judges a 
threatening event likely. A crisis management center pro- 
vides current intelligence and some short-term judgments to 
support decision-making, and facilitates timely communication 
among all U.S. elements involved. 

In practice, the two functions are not mutually 
exclusive. Warning, timeliness and coordination are 
essential ingredients in each. Moreover, a situation which 
is being monitored for warning purposes may rapidly become 
a crisis, with actual or anticipated U.S. involvement. 
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Since the early 1960s the centers have been equipped 
with increasingly sophisticated communications and informa- 
tion handling systems. These technological advances have 25X1 

made possible timely and detailed ma nagement of operations 
at the national and comm and levels. 

ana computerized analytical aids has- 
raised expectations for the centers' performance in warning 
as well. The centers' increasing sophistication has created 
the illusion that, given adequate equipment, the center will 
be able to perform optimally both as a watch office and as 
a crisis management center. In practice, however, all of 
the centers have made trade-offs. The organization, manning, 
and procedures adopted to optimize performance in one role 
sometimes detract from performance in the other. 

Three choices bear on a center's capabilities for 
warning and for crisis management. They include: 

• the choice between rapid response (essential 
to crisis management and to certain warning situations) , 
and strategic warning analysis; 

e between requiring a center to produce current 
intelligence (as it must to support crisis management) 
and keeping it free to monitor warning indicators; and 

© between coordination and diversity in intelligence 
production . 
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Following is a review of past and present watch centers, 
and a discussion of these three recurring trade-offs. 

The discussion illustrates the importance of leadership to 
ensure that, as each center makes the necessary trade-offs, 
the community as a whole maintains strong capabilities for 
warning and for crisis management. 


A. Definition 

A watch center (or intelligence operations center) 
is an intelligence facility operating 24 hours a day, equipped 
with the necessary communications and personnel to be able 
to monitor collected intelligence and alert users rapidly 
of its significance.. 

In the Washington area, there are watch centers at 
five major government elements: 
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B. Historical Development 

All-source, national watch centers are a relatively re- 
cent phenomenon. Of the Washington area centers listed above 
only the CIA's existed prior to the early 1960s. \ 


Prior to the 1960s there was only one watch center 
engaged in strategic warning — that is, systematically 
monitoring indicators of hostile activity. This was the 
National Indications Center (NIC) , established in 1954 • 
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as a professional staff for the Watch Committee, an inter- 
agency body that , after 1958, reported to the United States 
Intelligence Board (USIB) . Consisting of personnel from 
the USIB agencies, the NIC included a Watch Alert 
Group operating on a 24-hour basis. The NIC staff developed 
and updated lists of indicators of hostilities, and followed 
the flow of intelligence concerning the Soviet Union, 

China, North Korea, and — as U.S. involvement in Vietnam 
grew — other problem areas as well. Every morning the 
NIC published a brief summary of developments over the previous 
24 hours of possible warning significance. The Watch 
Committee Report, issued following each weekly meeting 
and occasional special meetings, presented the coordinated 
views of the intelligence community. Footnotes 
registering dissent were used rarely. 

During the Kennedy administration, partly in response 
to the Bay of Pigs and the Cuban missile crisis, watch 
centers were established at the White House and at INR, 
and the watch office at CIA was substantially upgraded. 

DIA was established, and in 1961 the Air Force Current 
Intelligence and Indications Center was transferred to it. 
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By the early 1970s improved communications kept the 
Washington area watch centers in touch with each other 
and with centers at the Commands around the world. Techno- 
logical advances included improvements in secure voice 
communications, and facsimile transmission capabilities 
among Washington area centers. Equally important, procedures 
for communications and for distributing intelligence 
products had been refined, partly in response to crises 
such as the Pueblo and the EC-121. Agreements had been 
made to facilitate communication between operations and 
intelligence, and some problems of compartmentation had 
been overcome. The NOIWON network was established in 1974. 
With the establishment of the National SIGINT Operations 
Center at NSA in 1973, watch centers operated at every 
community element. Procedures for crisis management 
and emergency task forces have been developed at each one, 
and a system for producing an inter-agency situation 
report created. 

As the Washington area "warning community" matured, 
the continued role of the Watch Committee and NIC was 
cast in doubt. The NIC's 24-hour capability was no 
longer required. The Watch Committee Report involved 
a lengthy process of coordination which appeared unnecessarily 


SECRET 

Approved For Release 2004/05/21 : CIA-RDP81M00980R0031 0001 0057-5 



Approved For Release 200^/05{|1 ^IA -RDP81 M00980R0031 0001 0057-5 8 4 


cumbersome now that the watch centers could be in timely 
communication with each other. Over the years the Watch 
Committee and NIC had been required to broaden their warning 
attention, and ultimately devoted much of their attention to 
problems outside of their original "big W" mandate. The 
final blow to the Watch Committee/NIC mechanism occurred iji 
1973, when the intelligence community failed to warn of 
the October War. The Watch Committee received much of the 
blame for this failure at the time, as the process of intelli- 
gence coordination was believed to have "watered down" 



Watch Committee and NIC with a Strategic Warning Staff (SWS) , 
which would report to the DCI through a Special Assistant 
for Strategic Warning. Like the Watch Committee, the SWS 


is located at the Pentagon. Its director is named by the DCI 
The mandate of the SWS is focused strictly on the "big W" 
problem. Unlike the NIC, the SWS does not operate on a 24- 
hour basis, nor does it produce current intelligence. 

Its small staff monitors long-range warning problems, and 
develops and revises lists of indicators to guide warning 
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analysis and form a basis for collection. Their weekly and 
monthly publications are not formally coordinated, although 
they are circulated for comment or revision before publica- 
tion, and occasionally carry dissenting notes from one or 
more agencies. 

In recent years, efforts throughout the community have 
been aimed to enable the watch centers to detect an unusual 
pattern more rapidly, to confer quickly with each other, to 
produce current intelligence more rapidly, to cope with a 
flood of incoming traffic, and to support crisis management 
efforts. Communications procedures have been refined: 
further instructions for NOIWON use were issued after the 
Mayaguez; a directory of alert centers have been published; 
a new CRITIC Handbook has been issued. Automated traffic 
dissemination systems have been adopted or are planned. 
In-depth analysis of indicators and of warning significance 
or current trends continues to be the particular responsi- 
bility of SWS. 

C . Three Trade-offs 

1. Rapid R es ponse or Strategic Warning Analysis 

To maximize its rapid responce capability, a watch 
center must operate 24 hours a day. Its analysts should have 
the necessary automated aids to reduce the time it takes 
to receive and send messages, confer with other analysts, 
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produce intelligence reports, and disseminate intelligence 
products . 


procedures must be sufficiently uniform to require rela- 
tively little subjective judgment. 

• > *' 

Strategic warning analysis does not require a 
daily 24-hour capability. The essential ingredient is 
highly motivated and experienced analysts. The emphasis 
should be on in-depth, cumulative warning analysis — con- 
sidering current events' in the context of earlier ones, 
including information that cannot be quantified. Efforts 
should be made to divorce this analysis from pressures of 
current production and to employ methodologies to overcome 
analytical bias, to insure that the right questions are 
asked, and that alternative hypothesis are considered. 

Clearly, both rapid response and in-depth strategic 
warning anlysis are essential to warning. However, it is 
impossible for a single watch center to perform optimally 
in both capacities. The personnel in a 24-hour facility must 
to a certain extent cover for each other; in-depth expertise 
in one area may be less important than familiarity with 
procedures and general understanding of the region. The 
particular demands of 24-hour work are not conducive to 
retaining experienced analysts for long periods of time. 
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The Watch Committee/NIC mechanism was intended 
to serve both functions. Increasingly, maintaining a 24- 
hour rapid response capability limited its ability to per- 
form strategic warning analysis. The recent modernization 
of the NMIC is intended to improve performance in both areas 
On the one hand, sophisticated automated systems are in- 

* 

tended to save time. On the other hand, substantive ana- 
lysts from DIA's Current Intelligence Division now man the 
Alert Center at all hours; this, together with changes in 
the daily production schedule, is intended to facilitate 
more analytical production. These DIA efforts have been 
somewhat successful, although the emphasis is still on cur- 
rent intelligence production, rather than strategic warning 
analysis. Although CIA's Operations Center is also manned 
by analysts rather than watch officers, it is small in size 
and serves largely as a center for communications and rapid 
response. It has little capability for cumulative strategic 
analysis that is delegated to the various analytical 
offices in the National Foreign Assessment Center (NFAC) . 
This arrangement is organizationally sound, but its ef- 
fectiveness depends on strong production management to 
insure that a warning perspective is maintained in all of 
these analytical elements, and such management is uneven. 
(See Section IV, "Lesson 3".) 
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2. A Watch Office or a Current Intelligence Productio n 
Element 

In theory, warning is quite different from current 
intelligence. (See Section II.) In practice, most warning 
analysis is performed by current intelligence analysts, 
and watch centers are typically also current intelligence 
production offices. This involves a dilemma. 

On the one hand, it is desirable to free warning 
analysts from the demands of a regular current intelligence 
production schedule. Good warning analysis requires taking 
the time to consider aspects of a situation that may no 
longer have any current intelligence interest. Current in- 
telligence producers are subjected to a heavy demand for 
briefings and other current intelligence products during a 
crisis, which is when their sustained attention to warning 
indicators is needed. 

On the other hand, warning analysis cannot occur 
in isolation from current intelligence. There are several 
reasons for this. First, if personnel at a 24-hour 
facility were not producing current intelligence, they 
would be serving as watch officers, a tedious and unre- 
warding role for an analyst; it would be difficult to keep 
experienced and well trained analysts in a position that 
involved little or no intelligence production. Second, 
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a warning analyst needs to be fully aware of current events 
in order to interpret indicators, and alert others quickly 
with the necessary credibility and sound reasoning. A 
watch center's production role may also help give it the 
necessary stature and credibility within the intelligence 
community to make its warning effective. 

Because the Watch Committee was seen to have bogged 
down in current intelligence production, designers of 
the SWS deliberately exempted it from a current production 
role. This has enabled it to perform a unique and necessary 
function, devoting its full resources to warning analysis. 

The arrangement, however, has also contributed to the relative 
isolation of the SWS. The isolation undermines its warning 
effectiveness, since intelligence users and other community 
elements do not depend on the SWS regularly for information, 
or have routine dealings with it. 

With the organizational changes involved in its 
"modernization," the NMIC Alert Center has undertaken a 
larger share of DIA current intelligence production. 

Greater flexibility in the production schedule has removed 
some pressure, although NMIC Alert Center analysts still 
devote much energy to scheduled and ad hoc briefings. 

CIA's Operations Center has taken some steps in the 
direction in increased production, although it operates 
primarily as a watch center. It disseminates traffic, and 
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as necessary also alerts analysts in the various elements 
of NFAC . These include the Current Reporting Group (CRG) , 
which directs the production of CIA's major current in- 
t e ^li ( ? e nce products: the National Intelligenc e Daily (NID) , 
the Weekly , and the President's Dail y Brief (PDB) . 

At the State Department’s INR, small staff size . 
lessens the distinctions between watch center analysts, cur— 
rent intelligence producers, and other intelligence analysts. 
The Current Intelligence Staff at INR maintains a 24-hour 
watch, produces twice daily cable summaries, and works 
closely with other INR analysts who must come regularly to 
CIS offices in order to read compartmented traffic. 

— — C p° r din a tion or Diversity in Intelligence Produc t i on 
This dilemma is central to the entire intelligence 
process and to the organization of the intelligence community 
It has particular relevance to warning and to the role 
that watch centers should play in it. 

Strong arguments can be made in favor or a coordi- 
nation process such as occurred during the weekly meetings 
of the Watch Committee. The various community elements were 
required to face up to the differing views that each might 
hold. The process ensured that a minimum all would be aware 
of the same set of facts, so that differences in analytical 
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approach could be addressed more clearly. Dissident views 
within a given agency could also surface more readily 
through this process, as dissidents who might be present 
became aware that their views were held by others. This 
might have encouraged fuller consideration of hypotheses 
which otherwise would have been dismissed. 

Good arguments can also be made against coordinated 
intelligence. The process of writing a coordinated 
product requires time and resources, and is often an empty 
exercise in wordsmi thing . Unless the coordinated product 
is considered very important and has the full backing of the 
DCI and agency heads, there is a tendency not to assign the 
most valued personnel to produce it, but to retain them where 
their expertise is most needed. Finally, the wordsmithing 
process can easily result in overly homogenized judgments — 
ones which are less meaningful to the user than the independent 
and perhaps even contradictory judgments of the several 
intelligence agencies. In addition, it is widely believed 
(after the 1976 experience with the National Intelligence 
Situation Report) that no single format can meet the needs 
of the various intelligence consumers. 

One reason why the Watch Committee was abolished 
was because it was believed to have blurred the 
differing views within the intelligence community. That 
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particular danger no longer exists, in that its successor, 
the SWS, does not coordinate intelligence. At best, SWS 
tries to serve as a catalyst in focusing intelligence com- 
munity attention on the warning implications of a situation. 

But, as was discussed in Section III, neither the 
SWS nor the NIOs have fully replaced the Watch Committee in 
ensuring that all community elements focus on a given prob- 
lem. Greater communication between the analysts themselves 
and the regular use of the NOIWON among Washington area 
alert centers, address part of this problem. An alarming, 
time-sensitive piece of information will be immediately con- 
sidered by all the alert centers. However, this does not 
ensure community-wide attention to a slowly evolving situa- 
tion in a way that uncovers differences in the assumptions 
underlying the analyses of different agencies, or that ensures 
that the relevant facts are fully understood. Thus, avoiding 
excessive coordination has entailed some costs. 

D . Summary 

Two points emerge from this discussion of the trade- 
offs associated with watch centers: 

1) There is no single ideal balance between rapid re- 
sponse capability and cumulative analysis, between a watch 
office and a production element, or between coordination 
and diversity in intelligence production. Rather, since 
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real trade-offs are involved and no one center can maximize 
its performance in all capacities, it is desirable for the 
various watch centers to assume somewhat different roles. 

A degree of specialization may ensure that the community 
as a whole benefits from sustained attention to a warning 
problem, while fully meeting its responsibilities in current 
intelligence production and maintaining the necessary rapid 
response capability. The role that individual watch centers 
play may change over time in response to changes in the 
needs of their agency, to technological developments, or to 
other factors. 

2) Effective leadership is needed to ensure that these 
trade-offs are kept in balance throughout the community. At 
the present time, for example, attention and resources are 
focused, perhaps disproportionately, on improving traffic 
dissemination, communication, and rapid retasking of col- 
lection assets. 

DC I leadership — perhaps embodied in a full-time 
special assistant for warning — is needed to ensure that 
sustained, in-depth strategic warning analysis receives 
adequate resources and community attention. SWS , as the 
community element with particular responsibility for this 
analysis, should at a minimum be ensured of promptly re- 
ceiving all warning relevant intelligence, including 
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operational and policy information. SWS should play a less 
detached role in warning community efforts. Although a 
certain detachment is essential, it should avoid isolation, 
which interferes with its ability to play a leadership role 
when necessary in focusing community attention on a given 
problem. Beyond the SWS, DCI leadership should ensure 
adequate attention to warning analysis throughout the com- 
munity. The management role of NIOs in warning analyses — 
ensuring that the right questions are addressed and that 
alternative hypotheses are considered — needs to be emphasized. 
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VI. Assessment 
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VI • ASSES SMENT 

The intelligence community's capacity to provide warning 
can be evaluated by assessing past performance. The limita- 
tion of this approach is that major warning situations, 
which fully test the community's capacities, occur rarely. 

Although short-lived crises, in which intelligence is required 

. . * 

for crisis management more than for warning, take place 
somewhat more frequently, past events still do not provide 
an adequate measure of present capabilities. This is 
because the circumstances of each event differ, and because 
the intelligence community, responding to perceived problems, 
is continually changing: new collection systems are 
developed or improved, greater timeliness is achieved, and 
new procedures are adopted. 

An indirect approach, which has been used in this report, 
evaluates present warning capability by asking: how well 
has the "warning community" responded to the lessons of the 
past ? Past performance, as measured in post-mortems, other 
public and classified studies, and interviews by Committee 
staff, provides the essential basis for this approach. The 
focus, however, is on the community's response to weaknesses 
which have been identified repeatedly in those studies and 
interviews . 
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A. Conclusions 

As Section IV reported, some lessons are learned more 
readily than others. Emphasis on collection and on other 
problems that can be addressed primarily with technology 
has overshadowed attention to improving analysis and to 
minimizing uncertainty and confusion in the production 
process. 

The result is that intelligence performance in future 
warning situations is likely to reveal familiar weaknesses . 
Enough intelligence will have been collected, and, in 
general, processing and dissemination will be timely. Much 
of the analysis will be good. The warning judgments re- 
ceived by decision makers, however, will be less than clear 

and convincing. There may be several reasons: 

• Analysts may have failed to ask all the 

necessary questions. 

• One agency may have addressed the vital questions, 
but, unable to focus the mainstream of intelligence com- 
munity resources on the question, it may have hidden its 
warning judgment "under a bushel." 

• The formats and sheer volume of intelligence 
products may have failed to convey the increasing certainty 
felt by warning analysts. 
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• The expectation of completely unambiguous 
warning may have kept both producers and users from fully 
considering available "warning." 

The cost of these weaknesses is unnecessary surprise. 
This surprise is usually understood to involve an action, 
with little or no warning, affecting U.S. interests. Also 
costly is the uncertainty surrounding situations that may 
appear to be alarming but which do not represent the 
anticipated threat. Timely and accurate warning judgments, 
convincingly conveyed to decision makers, both help the U.S. 
to respond effectively to hostile action, and help avoid 
overreaction in other circumstances. 
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Greater communication among different elements of the 
intelligence community, and the development of procedures 
such as those which govern the use of the NOIWON and CRITIC 
systems, mark a maturation of the production side of the 
"warning community." Routine interaction among watch center 
personnel and other analysts has been facilitated not only 
by certain technical advances in communications, but by 
policy decisions to encourage such interchange. 

Automated traffic dissemination and storage systems, 
adopted in most Washington— area watch centers, have begun 
to produce some of the anticipated savings in production 
time. However, as the Subcommittee determined in a separate 
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2. Areas of Relative Neglect 

In contrast with the attention devoted to improving 

collection, timeliness, and even communications and resource 

management, relatively little attention has been directed 

toward problems in warning analysis and attitudes toward 

warning. Yet, as section IV demonstrated, past crises have 

. « 

repeatedly shown the need to ensure that the right questions 
are asked, alternative hypotheses considered, and analytical 
biases overcome. Equally important, they have shown that 
warning judgments must be convincing, and must provide the 
basis for policy-makers to understand when a substantial 
change in a situation is believed to be occurring. Finally, 
although it is more difficult to prove, attitudes of producers 
and users toward warning particularly the expectation of 
unambiguous warning — appear to have stood in the way of 
effective warning in some cases. 

No mechanism exists that encourages analysts to address 
the follow-on questions that are implicit in their assumptions 
about a situation — for example, to ask how likely the 
Czechoslovaks were to pursue the kinds of actions that 
would make the Soviet use of force necessary — or to ensure 
that analysts confront all reasonable alternative hypotheses . 
Some NIOs are either not sufficiently involved in current 
intelligence, or overly involved in other management functions 
to play a significant role in warning. The SWS , as discussed 
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in Section III, cannot require analysts throughout the 
community to address the warning implications of current 
events, or to confront each others' interpretations. 

Methodology, training and analytical support efforts 
are still in their infancy. Most analysis is performed 
entirely by intuitive, historical means. Although such 
means, employed by highly skilled and experienced analysts, 
ought always to play a major part in warning analysis, 
studies of past warning situations have repeatedly recommended 
building in techniques and procedures to overcome biases and 
to challenge widely held views. Modest efforts are being 
made to acquaint analysts with a variety of analytical 
techniques, but there is still little day-to-day encourage- 

25X1 


ment to consider current warning problems 
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No system of 'products exists to convey warning judgments 
clearly and persuasively to the user. Specific warning 
vehicles have been adopted and discarded. Warning products 
take many forms, and there is no systematic way for a user 
to compare today's intelligence judgment with yesterday's, 
and to perceive warning in terms of the rate of change in 
a situation. Much warning intelligence is presented as 
current intelligence, not embodying a judgment of likelihood 
or probability upon which the decision maker might base his 
actions. Proposals for a coherent family of warning products 
— intended to address this problem — have been made both at 
the community level and within DIA. The recent DIA report 
on upgrading the DoD Indications ■ System proposes some 
specific means to ensure that warning products actually 
convey a warning judgment. 

The intelligence community does little to improve users' 
or producers' understanding of the warning process. An 
exception is the adoption by the Defense Intelligence 
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School's I&W course of instructional materials such as the 
Handbook on Warning Intelligence , which points out many 
common fallacies about warning. The intelligence community 
missed, in its recent 


a major 


opportunity to address the widely held assumption that 

warning is a commodity than can be provided unambiguously 

* 

a certain number of hours before attack. Rather than 
stressing that analysis of events during the weeks or months 
of the "crisis of unprecedented severity" would form a 
major part of whatever warning intelligence is provided, 
the | Concentrates primarily on the warning problem during 


the last days and hours prior to attack. 

Problems that range from analysts 1 morale to wide- 
spread attitudes about warning itself cannot be remedied 
instantly. To a large extent, however, the persistance of 
these problems is attributable to a lack of adequate leader- 
ship in the "warning community." As section III concluded, 
the "warning community" itself is diffuse and its functions 
cannot be neatly separated from those of the rest of the 
intelligence community. The need for more focused leader- 
ship is evident, both at the community level and in the 
management of the DoD Indications System. 
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B. Recommendations 

1. The Director of Cen tral Intelli g ence 

The DC I must provide a focus for warning leader- 
ship in the community. Appointment of a special assistant 
for warning is desirable, and probably necessary as a means 
to this end. Such an official is not to provide warning; 
that is the function of analytic elements throughout the 
community. Rather’^ the official must ensure that the 
warning mission is adequately understood and carried out, 
and that the procedural, organizational, and doctrinal 
issues that affect the performance of the "warning com- 
munity" are addressed at appropriate levels. 

The DCI ' s focus for warning must assume the fol- 
lowing functions: 

• define explicitly the warning role of the NIOs; 

• oversee the Strategic Warning Staff, and enable 
it to contribute in a more vigorous and timely manner to 
community consideration of the "big W" problem; 

• provide for the adoption, evaluation, or dis- 
carding of warning mechanisms (such as Intelligence Alert 
Memoranda) ; 

• ensure that community-wide crisis management 
teams are established as necessary and provided with the au 
thority and access to perform their mission; 

• promote communication among members of the 
"warning community"; 
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• ensure that a review of all intelligence com- 
munity resources contributing to the warning mission occurs 
as part of the community's resource management process; 


• encourage the use and evaluation of appropri- 
ate structured methodologies in warning analysis, and ensure 
that adequate training and support is provided to analysts; 


• promote greater understanding of the warning 
process among both intelligence producers and intelligence 
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The CIA Operations Center 

The CIA Operations Center is a watch center, fully 
manned 24 hours a day. All intelligence wire traffic is 
received there, where watch officers scan it, monitor 
developing situations, and rapidly bring significant events 
to the attention of the DCI, the President, and other intel- 
ligence users. The Operations Center receives urgent 

,>> 

inquiries coming to the CIA; if it cannot provide a response 
on the spot, it draws on analytical resources elsewhere in 
the Agency, summoning the necessary experts when ■' 
necessary. 

Teams manning the Center consist of a senior watch 
officer and three watch analysts, each of whom monitors 
events in a region of the world . \ 


Clandestine reporting traffic is scanned by two officers 
from the Directorate of Operations (DDO) who are assigned 
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Substan- 


tive intelligence coordination for the entire Operations Center 
is the responsibility of a Senior Duty Officer. 


The CIA Operations Center also provides the eight or 
nine watch officers that man the White House Situation Room, 
and the CIA representatives to JCS/DIA and the NMCC. 
Evolution . ■* 

Development of the Operations Center has responded to 
two requirements: 



above, for the agency to be able to respond 24 
hours a day to consumers' requests. 

When the CIA was first established, night watch con- 
sisted of two junior employees, who answered the telephone 
and, if necessary, alerted other CIA personnel. In the late 
1950' s, as the current intelligence responsibilities of the 
Agency grew, a watch office was set up, and the position of 
Senior Duty Officer (a senior analyst) created. The watch 
office was the point. where all urgent traffic was received 
after normal duty hours. 
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Following the Cuban Missile Crisis an all-source 
analytical area was created, largely to enable analysts to 
make better use of material, which until then was 

available for reading only 
all-source watch center was created at this time, which 
included the necessary spaces for the operation of a crisis 

' * . m 

task force. To facilitate the use of clandestine reporting 
during crises, DDO' traffic was received in this area. Until 
four years ago, the Operations Center was run by the Office 
of Current Intelligence (OCI) in the Directorate of Intel- 
ligence (DDI) . 

In 1973 the Operations Center was removed from OCI and 
its Director was given greater responsibility over the 
watches maintained by the DDO and the DDS&T. At that time 
the Center's operating style was changed, with incoming 
traffic read on an all-source basis by young "watch analysts," 
each of whom concentrated on a geographic region. Before 
that time, traffic coming from different sources had been 
read by different watch officers, who had disseminated it 
to twenty or so recipients throughout the Agency. The ; 

watch center's substantive responsibility for warning had \ 

rested largely on the Senior Duty Officer. 
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Today the Operations Center is part of the National 
Foreign Assessment Center (NFAC) , established by joining 
the DDI and the National Intelligence Officers. 

Discussion 

1) The Operations Center serves as a communications 
center and a watch, office. It does not pretend to be a 
current intelligence production office. Its only products 
for users outside the CIA are the White House Spot Reports, 
which are special messages sent electrically and framed for 
inclusion in the briefing book given three times a day to 
the President's Advisor for National Security Affairs; and 
the VIP Movements Report. 

Although the Senior Watch Officers and the Senior Duty 
Officer are experienced analysts, the watch officers who man 
the desk are young — sometimes in their first year of service. 
The watch officer is not expected to be an expert on all the 
problems in the region of the world he monitors. Much of the 
time, he or she will refer an inquiry to other analysts in 
the building. 

2) The Operations Center is small. No separate communi- 
cations center is required, as the cable circuits are 
located within the Center. A cable clerk scans incoming 
traffic for precedence, distributes the FLASH and CRITIC 
messages, and puts the others into boxes for each of the 
watch analysts, who pick up their mail once every 15 minutes 
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messages is received daily 
ticker items from the 


or so. An average of about 

(less on weekends) , plus some [ 

wire services. 

This method of distribution is currently being replaced 
by a computerized message processing system. At present this 
change appears to represent a step backward, in that the 
Computerized Dissemination System (CDS) requires that the 
analyst decide upori" seeing a message on the screen whether 
to retain the message. He must then have a hard copy made, 
which requires leaving his desk and walking over to the hard 
copy printer, near the Senior Duty Officer. Whereas the 
watch analysts now tend to keep track of a number of events 
by maintaining little stacks of cables on their desks, it 
seems likely that under the' new system they will be reluctant 
to monitor cases whose significance is not immediately 
apparent when the message first appears on their CRT screens. 

The CDS has been on-line for only six months, and, 
until its reliability has been assured, the Operations 
Center continues to read traffic coming in' on its teleprinters 
against the traffic appearing on the video screens. Even 
once its reliability is determined, the system's lack of 
archival, retrieval, file-building, and text-editing capabil- 
ities makes it a less than satisfactory replacement for 
manual hard copy distribution. 


Approved For Release 2004* 



RDP81 M00980R0031 0001 0057-5 


25X1 

25X1 





SECRET 

Approved For Release 2004/05/2 t-<§IA-RDP81M00980R0031 0001 0057-5 

When the CDS was adopted by CIA's Office of Communica- 
tions five or six years ago, it was widely assumed that the 
system would be connected with project . which is intended 25X1 

to serve the production offices at CIA and was envisioned 
to have all the necessary capabilities. However, develop- 
ment of the prototype system has not progressed as 

rapidly as anticipated, and will not be operational until - I 
the mid-1980s. 

4) The Operations Center is currently overseeing a crisis 
management project. The project, which has examined the 
information management problems faced during past crises, 
is testing the usefulness of a number of applications which 
could be built into the ADP system used both by the Opera- 
tions Center itself and in its task force or working group 
area. 

5) The strengths of the Operations Center include: 

— reasonably clear lines of authority, enabling 
coordination of resources from three directorates; 

— an established mission; strong demand for its 
regular products, and reliance on it by the rest 
of the community for mobilizing CIA resources in 
response to urgent requests. 

A weakness is: 

— limited capabilities of its computerized dissemination 
system (at least during interim period) . 
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